Intel Corporation

Mcafee, Inc.

Other

Hewlett-packard Development Company, L.p.

David M Durham

Ravi L Sahita

Siddhartha Chhabra

Michael Lemay

Karanvir S Grewal

Sergej Deutsch

Uday R Savagaonkar

Prashant Dewan

Gilbert A Neiger

Michael E Kounavis

Men Long

Hormuzd M Khosravi

Baiju V Patel

Barry E Huntley

Vedvyas Shanbhogue

Alpa T Narendra Trivedi

Travis T Schluessler

Andrew V Anderson

Santosh Ghosh

Carlos V Rozas

Deepak K Gupta

Rajat Agarwal

Balaji Vembu

Jason W Brandt

Ioannis T Schoinas

Gideon Gerzon

Abhishek Basak

Michael A Goldsmith

John Douglas Teddy

Francis X Mckeen

Ron Gabor

Russell Jerome Fenger

Vincent J Zimmer

Kirk S Yap

Vincent R Scarlata

Scott Dion Rodgers

David A Koufaty

Asit K Mallick

Jacob Doweck

Ned M Smith

Rajesh M Sankaran

Kapil Sood

Richard A Uhlig

John I Garney

Jr-Shian Tsai

Ernie F Brickell

Simon P Johnson

Howard C Herbert

Gary L Graunke

Dion Rodgers

Vadim Sukhomlinov

Stanislav Shwartsman

Jason Martin

Robert S Chappell

Ronak Singhal

Stephen R Van Doren

Stalinselvaraj Jeyasingh

Sailesh Kottapalli

Kshitij Arun Doshi

Manoj R Sastry

Geoffrey S Strongin

Alex Nayshtut

Scott R Janus

Sreenivas Subramoney

Oleg Pogorelik

Uttam K Sengupta

Wei Wu

Sanjay Bakshi

Robert L Vaughn

Xiaoning Li

Lenitra M Durham

Jayesh Gaur

Cedric Cochin

Nikhil M Deshpande

Mohan J Kumar

Shay Gueron

Patrick L Connor

Jesse R Walker

Hong C Li

Ravishankar Iyer

Raanan Sade

Andrew J Herdrich

Arvind A Kumar

James P Kardach

Sara S Baghsorkhi

Raj K Ramanujan

Ittai Anati

Anatoli Aleksandrovich Bolotov

Omer Ben-Shalom

Parthasarathy Sarangam

Ravi Rajwar

Mikhail I Grinchuk

Dan Baum

Niranjan L Cooray

Alexander Bachmutsky

Mingqiu Sun

Ronald Perez

Ian M Steiner

Beeman C Strong

Alpa Narendra Trivedi

In one embodiment, a multi-tenant computing system includes a processor including a plurality of cores on which agents of tenants of the multi-tenant computing system are to execute, a configuration storage, and a memory execution circuit. The configuration storage includes a first configuration register to store configuration information associated with the memory execution circuit. The first configuration register is to store a mode identifier to identify a mode of operation of the memory execution circuit. The memory execution circuit, in a first mode of operation, is to receive encrypted data of a first tenant, the encrypted data encrypted by the first tenant, generate an integrity value for the encrypted data, and send the encrypted data and the integrity value to a memory, the integrity value not visible to the software of the multi-tenant computing system. Other embodiments are described and claimed.

System, apparatus and method for integrity protecting tenant workloads in a multi-tenant computing environment

Systems, methods, and apparatuses for implementing micro-context based trust domains are described. In one example, a system includes a hardware processor core to implement a trust domain manager to manage one or more hardware isolated virtual machines as a respective trust domain with a region of protected memory, and assign a micro-context identification value, that is not readable by privileged system code that is to execute on the hardware processor core, to each granule of a plurality of granules of physical memory of the protected memory (e.g., where a granule is a proper subset of a page of memory relating to a single object in memory); and a memory management circuit coupled between the hardware processor core and the physical memory, wherein the memory management circuit is to prevent data in the protected memory having a first micro-context identification value from being accessed by code based on the code having a different micro-context identification value.

Circuitry and methods for implementing micro-context based trust domains

Systems and methods for memory isolation are provided. The methods include receiving a request to write a data line to a physical memory address, where the physical memory address includes a key identifier, selecting an encryption key from a key table based on the key identifier of the physical memory address, determining whether the data line is compressible, compressing the data line to generate a compressed line in response to determining that the data line is compressible, where the compressed line includes compression metadata and compressed data, adding encryption metadata to the compressed line, where the encryption metadata is indicative of the encryption key, encrypting a part of the compressed line with the encryption key to generate an encrypted line in response to adding the encryption metadata, and writing the encrypted line to a memory device at the physical memory address. Other embodiments are described and claimed.

Technologies for memory replay prevention using compressive encryption

Techniques disclosed include selecting a first key identifier (ID) for a first compartment of a compartmentalized process of a computing system, the first compartment including first private data; assigning a first extended page table (EPT) having at least one memory address including the first key ID; encrypting the first private data with a first key associated with the first key ID; and storing the encrypted first private data in a memory starting at the at least one memory address of the first EPT.

Fast key ID switching via extended paging for cryptographic intra-process isolation

An apparatus includes circuitry to receive a memory access request based on a memory address in a memory allocation of a program. The memory allocation is assigned to a slot of memory apportioned into a plurality of slots. The circuitry is to calculate an index based, at least in part, on whether a size of the slot exceeds a slot threshold size, and determine whether a buffer communicatively coupled to the circuitry includes a buffer entry corresponding to the index and containing a set of metadata associated with the memory allocation. Based on the slot size, the circuitry is to calculate the index by either determining a metadata virtual address or by determining a virtual address of a midpoint of the slot. The indexed data may include bounds and tag information for the circuitry to determine if a memory access is within the bounds and matches the tag value.

Efficient caching and queueing for per-allocation non-redundant metadata

An example method comprises storing, in a register, an encoded pointer to a memory location, where first context information is stored in first bits of the encoded pointer and a slice of a memory address of the memory location is encrypted and stored in second bits of the encoded pointer. The method further includes decoding the encoded pointer to obtain the memory address of the memory location, using the memory address obtained by decoding the encoded pointer to access encrypted data at the memory location, and decrypting the encrypted data based on a first key and a first tweak value. The first tweak value includes one or more bits derived, at least in part, from the encoded pointer.

Pointer based data encryption

Encryption interface technologies are described. A processor can include a system agent, an encryption interface, and a memory controller. The system agent can communicate data with a hardware functional block. The encryption interface can be coupled between the system agent and a memory controller. The encryption interface can receive a plaintext request from the system agent, encrypt the plaintext request to obtain an encrypted request, and communicate the encrypted request to the memory controller. The memory controller can communicate the encrypted request to a main memory of the computing device.

Encryption interface

Techniques for cryptographic computing isolation are described. A processor includes circuitry to be coupled to memory configured to store one or more instructions. The circuitry is to execute the one or more instructions to instantiate a first process based on an application. To instantiate the first process is to include creating a context table to be used by the first process, identifying a software component to be invoked during the first process, encrypting the software component using a first cryptographic key, and creating a first entry in the context table. The first entry is to include first context information identifying the encrypted software component and second context information representing the first cryptographic key. In more specific embodiments, third context information representing a first load address of the encrypted software component is stored in the first entry of the context table.

Cryptographic computing isolation for multi-tenancy and secure software components

A laminar flow purified air system includes a halo-shaped body configured to provide a laminar air flow barrier between a user of the existing hat and an ambient environment surrounding the user. Such a halo-shaped body has an air inlet and a laminar air outlet and a pressure chamber in fluid communication with both the air inlet and the laminar air outlet. The air inlet and the pressure chamber are configured to force laminar air out from the laminar air outlet and thereby create the laminar air flow barrier.

Laminar flow purified air system

Technologies provide domain isolation using encoded pointers to data and code. A system may be configured for decoding an encoded pointer to obtain a linear address of an encrypted code block of a first software component in memory. The first software component shares a linear address space of the memory with a plurality of software components. A processor uses the linear address to access the encrypted code block, determines a relative position of the encrypted code block within a memory slot of the linear address space, and decrypts the encrypted code block to generate a decrypted code block using a code key and a code tweak. The code tweak includes a relative position of the encrypted code block in the address space and domain metadata that uniquely identifies the software component. In some scenarios, the software component may be position independent code and may be relocatable to different address spaces.

Stateless and low-overhead domain isolation using cryptographic computing

Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

Cryptographic computing using encrypted base addresses and used in multi-tenant environments

A processor, a system, a machine readable medium, and a method. The processor comprises first circuitry to: encrypt a first code image using a first code key; load the encrypted first code image into a memory area allocated in memory for the first code image by an operating system miming on the processor; and send to the operating system a substitute key that corresponds to the first code key, wherein the first code key is concealed from the operating system; and an instruction cache including control circuitry; and second circuitry coupled to the instruction cache, the second circuitry to: receive the substitute key from the operating system; in response to a first request from the operating system to execute the first code image to instantiate a first process, perform a first cryptographic function using a hardware key to generate the first code key from the substitute key; and program the control circuitry of the instruction cache with the first code key to enable the first code image to be decrypted using the first code key.

Cryptographic computing in multitenant environments

In one embodiment, an apparatus includes a processor comprising at least one core to execute instructions of a plurality of virtual machines (VMs) and a virtual machine monitor (VMM), and a cryptographic engine to protect data associated with the plurality of VMs through use of a plurality of private keys and a trusted transformer key, where each of the plurality of private keys are to protect program instructions and data of a respective VM and the trusted transformer key is to protect management structure data for the plurality of VMs. The processor is further to provide, to the VMM, read and write access to the management structure data through an untrusted transformer key.

Seamless access to trusted domain protected memory by virtual machine manager using transformer key identifier

The technology described herein includes a first plurality of bijection diffusion function circuits to diffuse data bits into diffused data bits and store the diffused data bits into a memory; an error correcting code (ECC) generation circuit to generate ECC bits for the data bits; and a second plurality of bijection diffusion function circuits to diffuse the ECC bits into diffused ECC bits and store the diffused ECC bits into the memory.

Message authentication Galois integrity and correction (MAGIC) for lightweight row hammer mitigation

This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.

System for address mapping and translation protection

Growing community of inventors

Beaverton, OR, United States of America

David M Durham